A vulnerability in the OneFlow library allows unauthenticated attackers to cause a Denial of Service by supplying invalid device indices to the CUDA interface.

This vulnerability involves improper input validation within the flow.cuda.get_device_properties function. An unauthenticated attacker can trigger a system crash or service disruption by providing a negative or otherwise invalid GPU device index.

The exploitation of this flaw leads to a Denial of Service, which can result in significant downtime for applications relying on the OneFlow framework for machine learning or computational tasks. With a CVSS score of 7.5, the vulnerability is classified as High severity, reflecting the ease of exploitation over a network without requiring authentication. Such disruptions may hinder critical business operations and require manual service intervention to restore availability.

Immediate Action: Since a specific patch version is currently unknown, users should restrict access to the affected service to authorized networks only and monitor the vendor GitHub repository for upcoming security releases.

Proactive Monitoring: Security teams should monitor system logs for frequent crashes or exceptions related to the flow.cuda.get_device_properties function.

Compensating Controls: Deploy a Web Application Firewall or similar network security appliance to inspect traffic and filter requests that attempt to invoke computational functions with malformed parameters.

Public Exploit Available: Unknown

Given the High severity of this Denial of Service vulnerability, organizations should prioritize isolating affected OneFlow instances from public-facing exposure. While waiting for an official patch from the vendor, implement strict input validation and access controls at the network perimeter to mitigate the risk of exploitation.